1. Who we are and scope
NETZEN operates the Xexo brand and the website xexo.io. In this policy, "Xexo", "we", "us", and "our" refer to NETZEN. For privacy enquiries, contact hello@xexo.io.
This policy explains how we handle personal information when you visit our website, contact us, or use our AI solutions, automation services, consulting, and offers listed on Microsoft Azure Marketplace or Microsoft AppSource. It applies to offers that link to this policy. An offer-specific privacy notice may provide additional details about that service.
NETZEN is the data controller for information used to operate our website and manage our business relationships. When we process personal information on behalf of a customer, the customer generally acts as the controller and we act as a processor under its documented instructions and the applicable service and data processing agreements. For information about your employer's use of a service, contact your organisation first.
2. Information we collect
The information we receive depends on how you interact with us and which services you use. It may include:
- Contact and business information: your name, work email address, telephone number, company, job title, and information you provide in enquiries, meetings, or support requests.
- Account and transaction information: account, organisation, tenant, subscription, and order identifiers; service entitlements; and billing or purchase records relevant to your engagement.
- Technical and usage information: IP address, browser and device information, request timestamps, pages accessed, and diagnostic or security logs generated when accessing our website or services.
- Customer content: documents, prompts, files, workflow inputs, generated outputs, and related information that you or your organisation choose to submit or authorise us to access as part of a service. Such content may contain personal information.
We receive information directly from you, from your organisation or authorised integrations, and from Microsoft when you request contact or acquire an offer through its marketplace. Please provide only information needed for the relevant purpose. Do not submit sensitive personal information unless the service and our agreement expressly support its processing.
3. How and why we use information
We use personal information for the following purposes:
- Respond to enquiries and arrange consultations or demonstrations.
- Provide, configure, maintain, and support the services you or your organisation request.
- Manage customer relationships, subscriptions, invoices, and contractual obligations.
- Diagnose errors, maintain service reliability, and protect against unauthorised access, fraud, and misuse.
- Meet legal obligations and establish or defend legal claims.
- Send relevant business communications and, where permitted by law or with your consent, marketing communications. You can opt out of marketing at any time by contacting us or using an unsubscribe link where provided.
Where the GDPR or similar laws apply, our legal bases are performance of a contract or steps requested before entering a contract; legitimate interests in responding to business enquiries, managing relationships, and keeping our services secure, subject to your rights and interests; compliance with legal obligations; and consent where required. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Providing information is generally voluntary. If information is needed to fulfil a contract, verify access, or comply with the law, we may be unable to provide the related service without it.
4. Microsoft marketplace offers
If you request information, start a trial, or purchase a Xexo offer through Microsoft Azure Marketplace or AppSource, Microsoft may share business contact details and relevant account, subscription, or transaction information with us. We use this information to respond to your request, provision and support the offer, and manage the customer relationship.
Microsoft operates its own marketplace and processes information under its own terms and Microsoft Privacy Statement. This policy covers NETZEN's processing and does not replace Microsoft's privacy statement.
5. AI and customer data
When an agreed service includes AI or automation, customer content may be processed by the models, cloud infrastructure, and integrations selected for that service. The providers, data location, retention, and any use for model training depend on the service configuration and applicable provider terms and are addressed in the relevant service documentation or agreement. Contact us before submitting content if you need clarification about those arrangements.
Where we act as a processor, we handle customer content under the customer's documented instructions and data processing agreement. Customers are responsible for having a lawful basis to submit personal information and for configuring access and integrations appropriately.
AI features can generate recommendations and outputs. Any use of those features for decisions that have legal or similarly significant effects on individuals must be assessed and governed for the specific deployment, including the required notices, legal basis, and human review. This policy does not itself authorise such decision-making.
7. International transfers
Depending on the service and providers involved, information may be processed outside your country. Where a transfer requires safeguards under applicable data protection law, we use the relevant legal mechanism, such as an adequacy decision or standard contractual clauses, and additional measures where required. Contact us for information about the safeguards applicable to your service or to request a copy where available.
8. How long we keep information
We retain personal information for as long as necessary for the purpose for which it was collected, including to provide services, maintain business records, meet legal obligations, and resolve disputes. We determine retention by considering the type and sensitivity of the information, the duration of the relationship, contractual requirements, applicable statutory periods, and security needs.
Customer content processed on behalf of an organisation follows the retention, return, and deletion arrangements in the applicable service and data processing agreements. When information is no longer needed, it is deleted or anonymised, subject to legal retention requirements and the applicable backup lifecycle. Contact us for the retention arrangements relevant to your engagement.
9. Security
We apply technical and organisational measures appropriate to the nature of the information and the risks of processing, including access restrictions and confidentiality requirements. Specific security controls depend on the service and agreed deployment. No method of transmission or storage is completely secure. If you suspect a security or privacy incident involving our services, contact hello@xexo.io.
11. Your privacy rights
Depending on your location and applicable law, you may have the right to access your personal information, correct inaccurate information, request deletion, restrict processing, receive a portable copy, and object to processing based on legitimate interests or for direct marketing. Where processing relies on consent, you may withdraw it. These rights are subject to applicable conditions and exceptions.
To make a request, email hello@xexo.io. We may need to verify your identity and authority before responding, and will respond within the time required by applicable law. If your information is processed on behalf of your organisation, we may direct the request to that organisation or assist it in responding.
You may lodge a complaint with your local data protection authority, including the authority where you live, work, or believe an infringement has occurred. A list of European authorities is available from the European Data Protection Board.
12. Children and third-party services
Our website and services are intended for business use and are not directed at children under 18. If you believe a child has provided us with personal information, please contact us so we can investigate and take appropriate action.
Our website or services may link to third-party websites or connect to services selected by a customer. Their own privacy notices govern information they collect independently. Review those notices before providing information to them.
13. Changes and contact
We may update this policy to reflect changes to our services or legal requirements. The latest version will be published at this URL with its updated date. Where required, we will provide additional notice of material changes or request consent.
For questions about this policy, service-specific processing details, or privacy requests, contact NETZEN, operating as Xexo, at hello@xexo.io.